H3C 防火墙安全域基本配置

H3C 防火墙安全域基本配置

一、项目拓扑

二、项目需求

可通

三、配置步骤

1. 配IP地址

[R1]int g0/0
[R1-GigabitEthernet0/0]ip ad 1.1.1.1 24

[F2]interface GigabitEthernet 1/0/0
[F2-GigabitEthernet1/0/0]ip ad 1.1.1.2 24

1. 将接口加入Trust

[F2]security-zone name Trust
[F2-security-zone-Trust]import interface g1/0/0

1. 安全域配置

[F2]security-policy ip                                    //安全策略ip
[F2-security-policy-ip]rule name 1                        //规则1
[F2-security-policy-ip-0-1]source-zone trust            //源域 trust
[F2-security-policy-ip-0-1]destination-zone local        //目的域 local    
[F2-security-policy-ip-0-1]action pass                    //允许数据包通过
[F2-security-policy-ip-0-1]quit
[F2-security-policy-ip]rule name 2
[F2-security-policy-ip-1-2]source-zone local
[F2-security-policy-ip-1-2]destination-zone trust
[F2-security-policy-ip-1-2]action pass

四、测试

ping 可通